Project structure · Backend
NestJS project structure
Opens with creditsFor people who want a structured TypeScript backend with clear rules about where code goes. Every feature is a Nest module that owns its controller, service, DTOs, entities and tests, so the app grows by adding folders, not by stretching old ones. The tree follows one orders API from nest new to a codebase a whole team can run for years.
Curated by Tauseef FayyazIntermediate187 files and foldersNestJS 12.1, Node.js 24 LTS, TypeScript 6 (scaffold pin; 7.0 is out)Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you23 files and folders
- 2GrowingWhat a real app with features and tests adds+83 files and folders
- ProductionWhat running it for real users adds+35 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+46 files and foldersOpens with credits
How it is organised
- One module per feature: src/orders holds everything about orders (module, controller, service, DTOs, entity, tests). Do not split the app into top-level controllers/ and services/ folders.
- Controllers stay thin: they read the request, call a service and return. Business rules live in services, where unit tests can reach them without HTTP.
- Every request body is a DTO class with class-validator rules, and a global ValidationPipe with whitelist on rejects anything else. Responses go through response DTOs so internal columns never leak.
- Secure by default: the auth guard and throttler are global (APP_GUARD), routes opt out with @Public() and @SkipThrottle(), and app.useSecurityHeaders() (Nest 12.1) sets Helmet-style headers without an extra package.
- Global setup lives in one configureApp() function used by main.ts and every e2e test, so tests exercise exactly what production runs.
- TypeORM through @nestjs/typeorm, chosen because it is a Nest-maintained package and its repository injection fits Nest dependency injection and testing. Prisma is a fine alternative with its own docs chapter. The schema changes only through migrations committed to git; synchronize stays off.
- Configuration comes from environment variables, read once through @nestjs/config and validated at startup, so a missing secret stops the app instead of a request.
- Slow or flaky work (emails, webhooks) goes on a BullMQ queue, and enableShutdownHooks lets SIGTERM drain requests and workers before the process exits.
- Add Expert tooling (contracts, mutation tests, boundaries, release automation) when a team and several consumers make it pay; Nest monorepo mode (apps/ and libs/) comes only with a second deployable app.
At the top of the project
Open one in the explorer for the full story
- orders-api/
- .git/Git history. nest new runs git init for you unless you pass --skip-git.
- .devcontainer/A ready-made development container: Node, Postgres and Redis set up for VS Code or Codespaces.1 inside
- .husky/Git hooks managed by husky, installed by the prepare script.1 inside
- .vscode/Shared editor settings, recommended extensions and debug configurations.3 inside
- coverage/The test coverage report written by npm run test:cov.
- dist/Compiled JavaScript from nest build. Production runs dist/main.js.
- node_modules/Installed packages. Recreated from package-lock.json by npm ci.
- src/All application code. nest-cli.json points sourceRoot here.13 inside
- test/End-to-end tests: the whole app booted with the Nest testing module and called over HTTP with supertest.5 inside
- .editorconfigIndentation, line endings and final newline rules every editor understands.
- .envYour local secrets and settings: DATABASE_URL, REDIS_URL, JWT_SECRET. Never committed.
- .env.exampleEvery variable the app needs, with safe placeholder values. Committed.
- .gitignoreKeeps .env, dist, node_modules, coverage, logs and editor files out of git.
- .lintstagedrc.jsonWhich commands lint-staged runs on which staged files.
- .nvmrcPins the Node.js major (24) for nvm, fnm, CI and the Dockerfile.
- .oxlintrc.jsonOxlint rules. Nest 12 projects lint with Oxlint instead of ESLint.
- .prettierrcPrettier formatting rules: single quotes and trailing commas.
- AGENTS.mdInstructions for AI coding agents: how to run, test and where things go in this project.
- CLAUDE.mdOne line, @AGENTS.md, so Claude Code follows the same rules as other agents.
- compose.yamlStarts local Postgres and Redis with one command: docker compose up -d.
- nest-cli.jsonSettings for the Nest CLI: where source lives, which schematics nest g uses, build options and plugins.
- package-lock.jsonThe exact version of every installed package. Commit it.
- package.jsonDependencies and scripts: start:dev, build, lint, test, test:e2e. Says "type": "module".
- README.mdThe scaffold README about Nest itself. Replace it with how to run your API.
- tsconfig.build.jsonThe TypeScript settings for nest build: compiles the app without tests.
- tsconfig.jsonTypeScript settings: nodenext modules, decorator metadata, strict mode and Vitest globals types.
- vitest.config.e2e.tsVitest settings for e2e tests: runs only *.e2e-spec.ts files.
- vitest.config.tsVitest settings for unit tests: runs *.spec.ts files with globals on.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with NestJS.
- Roadmap· Node.jsBackend development roadmapAPIs, databases, auth, deploys
- RoadmapSQL and databases roadmapQueries, design, indexes, transactions
- RoadmapDevOps and cloud roadmapLinux, Docker, Kubernetes, AWS
- RoadmapChoosing the right database roadmapSQL, document, cache, search, vector and more
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· IntermediateRestaurant Kitchen Display System with Station RoutingA browser-based kitchen display system for small restaurants that takes orders from waiters and table QR codes, routes each item to the right station (grill, fryer, tandoor, drinks) and tracks prep times live. A realtime final year project for food service businesses that still run on paper chits.
- FYP idea· IntermediateApproval Workflow Engine with Escalations for Small OfficesAn approval workflow engine for small offices, schools and NGOs that turns purchase requests, leave, reimbursements and document sign-offs into tracked flows with deadlines, escalations and email or WhatsApp-style reminders. A no-code automation final year project with a durable workflow runtime and an audit trail.
- FYP idea· IntermediateSchool Report Card System with Configurable Grading Rules and Batch PDFsA web system for private schools to enter marks, apply their own grading and promotion rules, moderate results and generate hundreds of printable report cards in one batch. An intermediate final year project in education software with a real rules engine and a document generation pipeline.
See 9 moreShow fewer
- QuestionShould I learn TypeScript or Python first in 2026?Learn Python first if you are new to programming or drawn to data and AI. Learn TypeScript first only if you already know some JavaScript or are certain about web development, and even then learn plain JavaScript for a few weeks before the types. The second language is much easier than the first.
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
- QuestionI am graduating soon and feel like I learned four years of theory but cannot actually build software. What now?The gap between theory and building is common and closable. Building is a separate skill: breaking a vague idea into small steps, using real tools and finishing. Close it with one guided build, then one project you design yourself, shipped in small working slices. Your theory will start to make sense along the way.
- QuestionHow do I build a developer portfolio as a beginner with nothing to show?Start with two or three small but complete projects that solve a real problem, each with a clear README, screenshots and a live link or easy run steps. Put them on a simple one-page site or a tidy GitHub profile. Depth and finish matter far more than the number of projects or a fancy design.
- Resource· GuideNestJS DocumentationThe official documentation for NestJS, a TypeScript-first Node.js framework built around modules, controllers, providers and dependency injection, running on Express by default or Fastify. It covers fundamentals, validation, databases, authentication and authorisation, GraphQL, WebSockets, microservices, OpenAPI and testing. It suits developers who want structure for larger Node.js backends, and it will feel familiar to anyone who knows Angular or Spring.
- Resource· GuideThe TypeScript HandbookThe TypeScript Handbook is the official, free guide to TypeScript's type system from the TypeScript team, written for working programmers and kept current with each release. It covers everyday types, narrowing, functions, object types, generics, type manipulation, classes and modules, and it is designed to be read in a few hours. It suits JavaScript developers adopting TypeScript and anyone who writes types by copying patterns without understanding them.
- Resource· GuideVitest DocumentationThe official documentation for Vitest, the test runner built on Vite. Its getting started guide has you writing and running a real test in minutes, then covers matchers, async tests, setup and teardown, mocking (functions, modules, timers, dates, requests), snapshots, coverage, the UI dashboard and browser mode for component tests. It uses a Jest-compatible API, so it suits JavaScript and TypeScript developers starting to test, and teams moving from Jest.
- Resource· GuidePostgreSQL DocumentationThe official PostgreSQL manual for the current release: a tutorial, the full SQL language reference, every data type and function, server administration, and chapters on indexes, EXPLAIN and concurrency control. It is accurate, well written and the place to check any PostgreSQL behaviour before trusting a blog post.
- Resource· GuideOWASP API Security Top 10The OWASP API Security Top 10 (2023 edition) lists the most critical security risks in APIs, led by broken object level authorisation, broken authentication and broken object property level authorisation. Each risk comes with attack scenarios and prevention advice. It suits anyone building or reviewing backends, because these flaws are common, easy to miss in code review and often invisible in normal testing.
Checked against 20 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- NestJS docs: First steps
- NestJS application schematic (what nest new generates)
- NestJS resource schematic (what nest g resource generates)
- NestJS docs: TypeORM
- NestJS docs: Configuration
- NestJS docs: Validation
- NestJS docs: Logger
- NestJS docs: Queues
- NestJS docs: Lifecycle events and shutdown
- NestJS docs: Testing
- NestJS docs: Guards
- NestJS docs: Security headers
- NestJS docs: Rate limiting
- NestJS docs: Health checks (Terminus)
- NestJS docs: OpenAPI CLI plugin
- NestJS docs: Libraries and monorepo mode
- NestJS docs: Deployment
- TypeORM docs: Migrations
- Sentry for NestJS
- Testcontainers for Node.js
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com